Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GStreamer plugins can crash or be exploited to run malicious code
published 6 months ago
Summary
Several GStreamer plugins contain security flaws that could allow malicious actors to crash applications or execute unauthorized code. This could happen if users open specially crafted media files. To protect your system, update your GStreamer plugins to the latest version.
What to do
- Update canonical gst-plugins-bad1.0 to version 1.8.3-1ubuntu0.2+esm1.
- Update canonical gst-plugins-bad1.0 to version 1.14.5-0ubuntu1~18.04.1+esm1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | gst-plugins-bad1.0 |
< 1.8.3-1ubuntu0.2+esm1 Fix: upgrade to 1.8.3-1ubuntu0.2+esm1
|
| Ubuntu:Pro:18.04:LTS | canonical | gst-plugins-bad1.0 |
< 1.14.5-0ubuntu1~18.04.1+esm1 Fix: upgrade to 1.14.5-0ubuntu1~18.04.1+esm1
|
Original advisory text
gst-plugins-bad1.0 vulnerabilities
It was discovered that multiple plugins in GStreamer contained arithmetic
overflows. An attacker could possibly use this issue to cause applications
using the plugins to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2023-37329, CVE-2023-40474, CVE-2023-40475,
CVE-2023-40476)
It was discovered that the MXF demuxer plugin in GStreamer did not
properly manage memory. An attacker could possibly use this issue to cause
applications using the plugin to crash, resulting in a denial of service,
or possibly execute arbitrary code. (CVE-2023-44446)
It was discovered that the H265 codec plugin in GStreamer could be made
to write out of bounds. An attacker could possibly use this issue to
cause applications using the plugin to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2025-3887)
overflows. An attacker could possibly use this issue to cause applications
using the plugins to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2023-37329, CVE-2023-40474, CVE-2023-40475,
CVE-2023-40476)
It was discovered that the MXF demuxer plugin in GStreamer did not
properly manage memory. An attacker could possibly use this issue to cause
applications using the plugin to crash, resulting in a denial of service,
or possibly execute arbitrary code. (CVE-2023-44446)
It was discovered that the H265 codec plugin in GStreamer could be made
to write out of bounds. An attacker could possibly use this issue to
cause applications using the plugin to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2025-3887)
References
- https://ubuntu.com/security/notices/USN-8205-1 Vendor Advisory
Timeline
Published23 Apr 2026
Updated27 Apr 2026
First seen27 Apr 2026
Sources
USN-8205-1 · OSV
Track software like this
Free during beta